Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Fri, 20 Sep 2002 03:29:53 +0200

Hi Rajeev,

  > the prefix used in matching the source address
  > should also include the appropriate prefix(es) valid on the
  > previous access router. Since the access routers
  > are assumed to have a trust relationship, the
  > additional prefix(es) can be configured manually, 

=> So let me see if we're on the same page:
Following your suggestion, a malicious node (that has nothing to
do with FMIPv6) that happened to know the neighbouring 
prefixes, can spoof them and launch attacks on other nodes 
without being traced to the right link. Is this correct? 

or else, with
  > an API permitting, through HI/Hack.

=> I don't understand what you mean by this.

Hesham

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 19 Sep 2002 18:44:20 -0700

Hi,

> without being traced to the right link. Is this correct?

Not exactly since the Previous router can supply the exact
(previous) IP address of the MN. Of course a malicious node
could spoof that address itself, but that probability is smaller.
Furthermore, if we keep the tunnel lifetime short enough, the
incentive for launching an improbable "attack" is decreased even
more.

> => I don't understand what you mean by this.

I mean program the prefixes based on HI/HAck exchange.

-Rajeev